Authentication Event Feature Extraction for Unauthorized Access Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security mechanisms fail to detect unauthorized use of stolen credentials, allowing lateral movement within networks, as they cannot distinguish between authorized and unauthorized authentication events.
Innovation Solution
A machine-learning based approach is employed to differentiate between benign and unauthorized authentication events using a classifier trained on a dataset of features extracted from authentication events, enabling detection of lateral movement by identifying patterns and activities associated with unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security mechanisms are used to authenticate users, then the authentication process is simple and fast, but the system cannot detect unauthorized use of stolen credentials
Solution Approach 1:
The patent segments the authentication verification process into multiple independent analysis components: credential validation, behavioral pattern analysis, contextual risk assessment, and anomaly detection. Each component processes specific features independently and contributes to the overall authentication decision, enabling comprehensive security checking without requiring a single complex monolithic system
Solution Approach 2:
The patent introduces an intermediary authentication analysis system that sits between the user and the resource access system. This intermediary performs comprehensive credential verification and behavioral analysis, then provides authentication decisions to the resource access system. The intermediary handles the complexity of multi-factor verification and pattern recognition, allowing the resource access system to remain relatively simple while achieving high detection accuracy
2Measurement precision
If comprehensive authentication monitoring is implemented to detect lateral movement, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing baseline behavioral patterns, authentication sequences, and contextual relationships during normal operations. These pre-computed models are stored for rapid comparison during actual authentication events. The system also pre-identifies high-risk authentication paths and pre-prepares detection rules, enabling fast real-time analysis without extensive computational processing during the critical authentication moment
Solution Approach 2:
The patent applies partial action by focusing computational resources on analyzing only the most critical authentication features and high-risk scenarios. Rather than performing exhaustive analysis on every authentication event, the system selectively applies deep analysis only when anomaly indicators are detected or when authentication patterns match known attack signatures. This approach achieves high detection accuracy for malicious events while maintaining fast processing for normal authentications
Data Source
AI summary
In some examples, for a given authentication event between a plurality of devices in a network, a system identifies a set of events, at the devices, that are temporally related to the given authentication event. The system extracts features from the set of events by aggregating event data of the set of events. The system provides the extracted features to a classifier that detects unauthorized authentication events.